Privacy Policy

1. Who Runs Timely

Timely Bookings is built and run by Midway Systems Limited, a business registered in Zambia under PACRA BN No. 120261045265 and based in Lusaka.

Your data sits with us, and questions about it come to us directly: hello@midwaysystems.org.

2. The Information We Hold

When you book an appointment, we ask only for what the booking needs:

• Your name, so the salon knows who is arriving
• The phone number you pay from — mobile money runs on it
• Your WhatsApp number, when you give one, for confirmations
• The appointment itself — the service, the salon, the date and the time
• The payment trail: deposit amounts and transaction references. Card numbers are never stored on Timely
• Your IP address, recorded for security

Salons that join Timely give us more: the owner’s name, the business name and where to find it, contact and mobile money numbers, the service menu and its prices, portfolio photos, and details of the staff who take bookings.

3. What We Do With It

Everything on that list exists to make an appointment happen: confirm the slot, take the deposit, remind you before you arrive, and pay the salon its money.

Beyond the booking itself, we use the same records to improve how Timely works, to spot fraud and automated abuse, and to meet the record-keeping obligations Zambian law places on us. Nothing is sold, rented, or traded.

4. Your Mobile Money Number

Payments on Timely run on mobile money, so the number you pay from is a number we keep. It triggers the payment prompt on your phone through Lenco, receives your confirmation on WhatsApp or SMS, and — for salon owners — is where disbursements land.

Lenco, our payment processor, sees this number for one reason only: to move the payment.

5. The Partners Behind the Platform

Three services help Timely run, and each sees only the slice of your data its job requires:

Lenco

Moves the money — mobile money collections from customers and disbursements to salons. Lenco processes your mobile money number and transaction details under its own privacy policy.

Twilio

Carries our messages. Booking confirmations and notifications reach you over the WhatsApp Business API or SMS, which means your phone number and the message content pass through Twilio for delivery.

Render

Hosts the platform. Your data lives on servers operated by Render in the United States.

6. How Long We Keep Things

Your records stay while you use Timely. Ask us to erase them and we will, within 30 days — except for what Zambian law obliges us to keep.

Booking and payment records can stay for up to seven years, because accounting and tax rules demand it.

7. Your Rights

The Zambia Data Protection Act puts you in charge of your own information. At any time you can:

• Ask to see what we hold about you
• Have mistakes corrected
• Have your data deleted
• Object to a use of it you are not comfortable with

One email starts any of these: hello@midwaysystems.org.

8. Keeping It Safe

Protecting your data is engineering work, not a promise. These are the measures running on Timely today:

• Every connection is encrypted in transit (HTTPS/TLS)
• Card numbers are never stored — payments run on mobile money prompts, so there is nothing card-shaped to steal
• The database is firewalled: only the application can reach it, never the open internet
• Credentials and API keys live in server configuration, never in the code
• Role-based access: staff see only the data their role requires, and admin sessions expire automatically
• Login attempts are recorded and repeated failures are flagged
• Automated watchdogs check payments and bookings around the clock for duplicates, fraud, and bot activity
• Every page enforces strict content-security rules against injected scripts
• File requests are whitelisted and path-tampering is rejected
• Unusual activity raises real-time alerts to our team

Still, no system anywhere is beyond compromise. If you ever suspect your data has been exposed, tell us immediately at hello@midwaysystems.org.

9. Reaching Us